So now let's go back to the Endpoint Manager console,
and then we'll select Devices, go to Configuration profiles,
and then click Create profile.
So here we're going to select Windows 10 and later,
and choose Templates, and we'll choose PKCS certificates.
We'll click Create, and we'll provide a descriptive name here, and choose Next.
And, again,
we're going to have to answer some questions here
about this particular certificate.
So by default the renewal threshold is 20%, meaning that this certificate
will attempt to start the renewal process once it reaches about 20% of its
expected lifetime, and by default that's perfectly acceptable, so I don't
see any need to change that in here.
The default validity period for a certificate is 1 year, and again,
that's pretty much industry standard best practice so I'll leave that as well.
I certainly wouldn't go any longer.
I don't know that there's any value in going any shorter either, so
we'll just leave it at 1 year. Next we have the Key storage
provider. Here, this is critical, because we want to select Enroll
to TPM, otherwise fail. Now, the reason we do that is because we
want this to fail securely.
In other words, we don't want it to fail silently and into
a less secure configuration. We want to know that it's
failed so that we can address it.
We want to ensure that our certificates, and specifically the keys,
the private keys for these certificates, are well protected.
If they're not on a TPM,
they could be exposed to an attacker quite easily. Anyone with administrative
access on the endpoint can access those private keys if they're not in the TPM,
and so that represents a significant security risk. So we want this to fail hard
so that we can address the problem. Is it an endpoint that doesn't have a TPM?
Is it not configured correctly?
Maybe it needs to be reset, what have you, but you would rather
deal with that on a case‑by‑case basis rather than have it silently
fail back to an insecure configuration.
Up next, we want to choose our Certification authority,
and in this case this is just the FQDN of the issuing CA
server that we're going to use.
You may have more than one issuing CA, but you can only enter one here, so I'm
going to enter ours now. And then the next thing it's going to ask you is for
the Certification authority name, and this sounds a little bit redundant, but
it is just a little bit different.
And the way to find this information is actually to open a
command window on a domain‑joined server or workstation,
and once you've done that,
just simply type in the command certutil.exe without any values.
And in this case I have two CAs in my environment, as I
demonstrated earlier. This one is the one that I want, so
you'll see that Entry 1 has the name here.
So I'm going to go ahead and copy this information and then I will just
paste it into the Certification authority name field here.
The next is the template name, and this can be quite confusing.
So let's jump back over to our admin workstation
here, and if I look at this template,
you'll see that it's called Intune PKCS Enrollment.
That is what's known as the display name.
So let's go take a look at this really quick.
So I'm going to right‑click Certificate Templates,
choose Manage, and then I'm going to find that particular
template. And if I double‑click on this,
you'll see that it has a Template display name and a Template name.
That field that we're looking at wants the template name, not the display name.
In this scenario,
the template name is simply the template display name without
any spaces, and that's most common, but not 100% guaranteed,
so always take a look at that.
And then this is the information that you will input into the
device configuration profile. And in this case this is a
Device certificate, and by the way,
the template that we created in Active Directory can
be used for the user or the device.
What dictates whether it's a user or device certificate is right here.
So we'll select Device, and in the Subject name format for a Device
certificate, we want to use the fully qualified domain name, and so
that format is CN=, a couple of curly braces there, and then the word
FullyQualifiedDomainName. And we'll end that with a couple of extra
curly braces there.
It's important to note that this format is only available
for domain‑joined endpoints. However, for a device certificate,
the only scenario in which we really need to deploy that for
Always On VPN is if it's a domain‑joined computer. If it's not,
then we don't have to worry about this.
So in this case this is perfectly acceptable. Now
for the Subject alternative name, we're going to do the same thing here.
So we're going to select, in this case we're going to select
DNS and we're going to add that same subject name format, this
time without the CN=. Very good.
So moving on,
we need to set the Extended key usage, or EKU, and in this case
it's really easy because it's a predefined value.
So I'm going to select Client Authentication from this
drop‑down list, and then we'll choose next.
We will assign this, and in this case I'm going to assign it to my
VPN Devices again, because this is a device certificate, so I'll
choose Next, skip my Applicability Rules,
choose Next, and click Create. And that's it, we've deployed a
PKCS certificate for Always On VPN devices.
Now when those clients sync, they will get that certificate since
they already trust my hierarchy or my PKI, then they will enroll for this certificate successfully.